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© Antilock brake controller improvements. 

© A vehicle anti-lock brake system having a main 
microprocessor (1) and a fail-safe microprocessor (5) 
of a different type from the main microprocessor (1), 
and means interconnecting the main and fail-safe 



microprocessors and the remainder of the vehicle 
braking system so that the fail-safe microprocessor 
(5) can disable the brake release system (8) in- 
dependently of the main microprocessor. 



FIG. I 




11 



WHEEL SPEED 
SENSOR 



CM 
00 

in 

CO 



LU 




r 



BRAKE— RELEASE 
DRIVE 
CIRCUIT 



10 



MAIN 


ABS 




MICROPROCESSOR 




13 — 




12 


FAIL- 


SAFE 




MICROPROCESSOR 





14 



DRIVE ENABLE 
SWITCH 
CIRCUIT 




— 15 



-17 



16 



Xerox Copy Centre 



BNSDOCID: <EP 0395829A1_I_> 



EP 0 395 829 A1 



BACKGROUND OF THE INVENTION 



1. Reld of the Invention 

This invention relates to an electronically con- 
trolled anti-lock braking system (ABS) for a motor 
vehicle. 
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2. Description of Related Art 

Electronically controlled ABS systems are 
known in which a microprocessor is used to control 
release of the brakes of a motor vehicle in re- 
sponse to a determination by the microprocessor 
that the brakes have locked or are approaching a 
locked up condition. When such a determination is 
made, a signal from the controller typically ac- 
tuates an electro-magnetic brake release, e.g., a 
solenoid controlled valve in the brake system. 

A determination of wheel locking generally re- 
quires measurement of actual wheel speed or de- 
celeration, and a determination that the actual 
wheel speed or deceleration is respectively lower 
than or greater than a predetermined wheel speed 
or deceleration limit indicative of an incipient 
wheel-lock situation. It is also possible to make the 
determination based on a measurement of actual 
G- force and comparison with a wheel-speed de- 
rived G-force curve. 

^ Such systems are all subject to the common 
problems of spurious determinations resulting from 
controller malfunction, and malfunctions in the 
electro-magnetic brake release. Improper function- 
ing of the ABS can, of course, lead to disastrous 
consequences, either from failure to release the 
brakes when the wheels are locked, or from an 
unintended brake release when braking is required. aq 

As a result, it has been proposed to provide 
fail-safe circuits for the main controller, and to 
provide feedback from the brake release to the 
controller in order to permit the controller to moni- 
tor the brake release. Such proposals have not 45 
proven to be adequate, given the life-threatening 
potential of even one malfunction. 

A typical "fail-safe" ABS is shown in patent no. 
4,700,304, to Byrne et al. In Byrne et al, an analog 
fail-safe circuit is provided which includes a fuse in so 
series with the drive circuits of an electro-magnetic 
brake release. When the fuse is blown, the brake 
release is prevented from operating. 

The central ABS controller is a microprocessor 
which sends out periodic pulses to the fail-safe 55 
circuit which disables the fail-safe means from 
blowing the fuse. The fail-safe circuit of Byrne et al. 
cannot act independently of the microprocessor, 
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being completely dependent on proper output by 
the microprocessor of the periodic pulses. If no 
pulse is received within a predetermined period of 
time, the fuse automatically blows, but as long as 
the pulses are received, the fail-safe means is 
disabled. 

An analog system of the type shown in Byrne 
et al., in addition to being subject to such micropro- 
cessor internal errors as, for example, misreading 
of a brake-release feedback signal, suffers from an 
unacceptably slow response time. As a result, it 
has been proposed to substitute a microprocessor 
for the conventional analog fail-safe circuit. 

An example of a system which uses separate 
microprocessors for detecting malfunctions is dis- 
closed in patent no. 4,709,341 to Matsuda. In Mat- 
suda, identical microprocessors are provided which 
monitor each other in addition to performing as 
ABS controllers for respective wheels of the motor 
vehicle. Due to costs, such a system is suitable 
only where separate controllers are required, and in 
addition suffers from the drawback that it is subject 
to systematic errors from such sources as radio 
frequency interference and power supply fluctu- 
ations which affect all of the identical microproces- 
sors of Matsuda in exactly the same way due to 
their identical structure and functions. 



SUMMARY OF THE INVENTION 



It is an object of the invention to overcome the 
drawbacks of the prior art by providing an ABS fail- 
safe controller which includes a fail-safe micropro- 
cessor independent of the main controller. The fail- 
safe microprocessor of the subject invention is 
capable of disabling a brake-release means either 
upon detection of main controller malfunction or 
upon detection of brake-release failure. 

The fail-safe microprocessor is programmed to 
read periodic pulses from the main controller, the 
pulses being indicative of proper main controller 
operation, and to prevent the brake-release from 
operating when the pulses are not detected. 

Furthermore, even when pulses are detected, 
indicating proper main controller operation, the fail- 
safe microprocessor will still disable the brake- 
release upon detecting, independently of the main 
microprocessor, that the brake-release is malfunc- 
tioning. Separate feedback lines are provided to 
permit both the main controller and the fail-safe 
microprocessor to monitor the brake-release. 

The fail-safe microprocessor is advantageously 
a one-bit microprocessor programmed to monitor 
several different brake-release means without the 
need for multiple analog fail-safe circuits. 

Control of the brake-release means is prefer- 
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ably implemented via a switch in the drive circuit of 
the brake-release and responsive to pulses output 
by the one-bit microprocessor, failure of which 
automatically opens a switch. 

An especially advantageous embodiment of the 
one-bit microprocessor includes a timer for inde- 
pendently monitoring the solenoid on-time of the 
brake-release, the microprocessor being capable of 
shutting down the brake-release if the on-time ex- 
ceeds a predetermined value. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Figure 1 is a schematic view of a preferred 
embodiment of the invention. 

Figures 2 and 3 illustrate the operation of the 
fail-safe microprocessor of the preferred embodi- 
ment. 

DESCRIPTION OF THE PREFERRED EMBODI- 
MENT 



Figure 1 shows the main elements of an exem- 
plary ABS fail-safe system according to the present 
invention. In Figure 1, controller 1 is a control 
circuit or control microprocessor for determining an 
incipient wheel-lock condition in response to an 
input from wheel speed sensor 2 along line 3. 

The wheel speed sensor 2 is responsive to the 
passage of magnetic elements 4 which rotate with, 
for example, the differential gearing of a motor 
vehicle axle (not shown), and thus provides a signal 
indicative of the speed of the wheel or wheels 
connected to the axle. An especially advantageous 
sensor of this type is shown in patent no. 4,724,935 
to Roper, incorporated herein by reference, al- 
though any sensor arrangement which provides a 
signal indicative of wheel speed or changes in 
wheel speed could be used in connection with the 
preferred embodiment of this invention. 

The controller 1 may, for example, be a micro- 
processor of the type shown in the above-men- 
tioned patent to Roper, incorporated by reference 
herein, which operates by selecting, according to 
input from the wheel speed sensor, an appropriate 
deceleration reference curve. The selected refer- 
ence curve, when crossed by an actual wheel 
speed curve, indicate an incipient wheel lock con- 
dition, and the controller subsequently provides a 
signal which causes braking pressure to be re- 
duced, releasing the brakes. 

The main controller 1 of the preferred embodi- 
ment, however, need not be limited to the particular 
controller described above. The specifics of incip- 
ient wheel lock determination form no part of the 
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instant invention. The preferred failsafe system 
may be applied to a wide variety of main ABS 
controllers. 

Upon determination of an incipient wheel lock 
5 condition, main controller 1 provides a signal along 
line 9 to brake-release drive circuit 7 which causes 
drive circuit 7 to actuate solenoid 8, opening a 
valve 8' for modulating the brakes B of the vehicle 
(not shown). 

10 In order to ensure that short circuits between 

the vehicle frame and the solenoid do not affect the 
controller, the solenoid is switched on its high 
voltage side. For example, one side of the solenoid 
may be pulled high to 12 volts when turned on by 
is the controller. No circuit malfunction occurs if this 
lead shorts to the frame. If the high side solenoid 
lead shorts to the frame, the control system fails 
safe and does not turn the solenoid on, preventing 
damage to the controller. 
20 When the main ABS microprocessor 1 is op- 

erating properly, it provides a periodic signal along 
status line 13 to a fail-safe microprocessor 5. The 
periodic signal may be in the form of a pulse 
automatically generated once every cycle, of a 
25 main control loop, or it may be generated, for 
example, in response to an internal microprocessor 
diagnostic routine. 

Fail-safe microprocessor 5 is for example a 
one-bit microprocessor different in type from the 
30 main microprocessor. This will lessen the possibil- 
ity of systematic errors in both the main micropro- 
cessor and the fail-safe microprocessor. 

Fail-safe microprocessor 5 outputs a signal 
along line 15 through AC coupling integrator 17, 
35 which enables brake-drive enable switch 6 when no 
malfunction is detected by the fail-safe micropro- 
cessor. The AC coupling may include capacitors 
Ci and C2, and resistor R1, thus serving to in- 
tegrate a pulsed output on line 15, which can then 
40 be level detected by switch 6. 

Failure to receive a periodic signal along status 
line 13 within a predetermined time period is inter- 
preted by fail-safe microprocessor 5 as a malfunc- 
tion in the main microprocessor 1, and the fail-safe 
45 microprocessor consequently ceases to enable 
brake-drive enable switch 6, causing the brake- 
release to shut down. 

In addition to lines 13 and 15, which respec- 
tively serve to carry signals indicative of main 
50 controller health and to carry an independently 
generated fail-safe signal for controlling drive en- 
able switch circuit 6, lines 11, 12, and 10 are 
provided to provide feedback to the main micropro- 
cessor and the drive enable switch circuit regarding 
55 operation of drive enable switch circuit 6 and 
brake-release drive circuit 7. 

Feedback lines 11 and 12 are connected, re- 
spectively, between main controller 1 and brake- 
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release drive circuit 7, and between main micropro- 
cessor 1 and drive enable switch circuit 6. Feed- 
back line 10 is connected between a logic input of 
fail-safe microprocessor 5 and brake release drive 
circuit 7. In addition, both main controller 1 and s 
feed-back microprocessor 5 are capable of moni- 
toring additional brake-release solenoid drive cir- 
cuits, e.g., for each axle of a truck. 

Referring to Figures 2 and 3, the one-bit micro- 
processor performs two primary monitoring func- 10 
tions. The first, indicated by reference numeral 

1000, is the main controller monitoring function 
described above. As indicated by function step 

1001, if toggling of status line 13 by the main 
microprocessor fails, then the failsafe microproces- is 
sor disables the drive enable switch circuit. 

The second function of the fail-safe micropro- 
cessor 5. indicated generally by reference numeral 

1002, is to monitor the on-time output of the brake- 
release drive circuit. 

The failsafe microprocessor monitors the on- 
time of the output of the brake-release drive circuit 
for a predetermined time interval, e.g., 200 ms, as 
indicated by steps 1004 and 1005 of the on-time 
algorithm, shown in Figure 3. If the solenoid which 
is connected to the output of the brake release 
drive circuit is still on after the predetermined time 
interval, then the fail-safe microprocessor disables 
the drive enable switch circuit to disable the brake 
release. 

The one-bit microprocessor of the preferred 
embodiment uses a 200 ms timer because at slow 
vehicle speeds, under appropriate conditions, the 
main microprocessor algorithm does not require a 
longer on-time, and therefore a solenoid on-time of 
longer than 200 ms would indicate a malfunction 
and result in an unnecessarily long and possibly 
hazardous brake-release. 

However, under certain circumstances, and es- 
pecially at higher speeds, longer on-times may be 
needed. This is accomplished in a very simple 
manner while maintaining the 200 ms fail-safe ca- 
pability, by pulsing or turning off the brake-release 
solenoid for short periods to reset the 200 ms 
interval timer. Under slippery road conditions at 
high speeds, the main microprocessor may be 
programmed to require brake-releases of as long 
as 3 seconds, in which case the solenoid might, by 
way of example, be momentarily pulsed off every 
60 ms to reset the 200 ms interval timer. Such 
momentary pulsing would not affect the brake re- 
lease performance of the solenoid. 

Thus, the fail-safe controller of the preferred 
embodiment is responsive to both failure of the 
main microprocessor and to malfunctions in the 55 
solenoid which are independently detected, to shut 
down the brake-release function of the anti-lock 
braking system whenever there is a malfunction 
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that could affect braking performance. 

It is to be understood that the invention is not 
to be restricted to the details of the specific em- 
bodiment described, but rather that the scope of 
the invention should be limited only by the appen- 
ded claims. 



Claims 

1. In an anti-lock brake system for a motor 
vehicle, said system including means for sensing 
the rate of rotation of a member whose rate of 
rotation is indicative of the speed of a wheel of said 
vehicle; means for generating a wheel speed signal 
indicative of said rate of rotation; a main control 
circuit having means for determining an incipient 
wheel-lock condition based on said wheel speed 
signal and means for generating a brake release 
signal upon determining said incipient wheel-lock 
condition; ard means for releasing a brake in re- 
sponse to said brake-force release signal, the im- 
provement comprising: 
a main microprocessor; 
a fail-safe microprocessor of a different type; 
means for connecting said main microprocessor to 
said brake-release means such that the main 
microprocessor monitors whether said brake-re- 
leasing means has released said brake in response 
to said brake-force release signal; and 
means for electrically connecting said fail-safe 
microprocessor and main microprocessor such that 
the fail-safe microprocessor monitors said main 
microprocessor; 

said fail-safe microprocessor including means for 
preventing release of said brake by said brake- 
release means upon either a determination that 
said brake-release means is functioning improperly 
or a determination that said main microprocessor is 
functioning improperly; 

whereby said fail-safe microprocessor is capable of 
disabling said brake-release system independently 
of said main microprocessor. 

2. The anti-lock brake system of claim 1, 
wherein said failsafe microprocessor includes a 
timer for monitoring the on-time of said brake- 
releasing means, and including means for prevent- 
ing release of said brake when said on-time ex- 
ceeds a predetermined on-time limit. 

3. The anti-lock brake system of claim 2, 
wherein said fail-safe microprocessor includes 
means for resetting said timer by momentarily turn- 
ing the timer off when said main microprocessor 
requires that the solenoid on-time exceed said pre- 
determined on-time limit. 

4. The anti-lock brake system of claim 1, 
wherein said brake-release means includes a valve 
controlled by a solenoid and arranged to release 
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the brake upon activation of the solenoid. 
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